Kaspersky Next XDR Expert
1.1.9
Threat response  >  Response actions  >  Responding through Check Point NGFW

Responding through Check Point NGFW

Expand all | Collapse all

Check Point NGFW is a solution that acts as a filter for internet traffic in corporate networks. Integration with Check Point NGFW allows you to block IP addresses and URLs detected by Kaspersky Next XDR Expert.

Check Point NGFW includes features of unified threat management solutions and provides the following means of protection for corporate networks:

  • Firewall—Filtering network traffic, to protect the network from unauthorized access.
  • Intrusion and attack protection—Identifying and blocking suspicious actions, to ensure system integrity.
  • Anti-virus traffic scanning—Protecting against malware and malicious activities.
  • Application control—Blocking or restricting execution of unauthorized applications.
  • Web filtering—Restricting user access to websites that you consider unwanted.

Check Point NGFW version R81.20 or later is supported.

You can respond to alerts and incidents through Check Point NGFW if you previously configured integration between Kaspersky Next XDR Expert and the script launch service, as well as created a playbook that will launch a script for responding. To unblock the IP addresses or URLs that have been blocked, you have to create and launch another playbook.

Python 3.10 is required to run the scripts.

To perform a response action through Check Point NGFW, you must have one of the following XDR roles: Main administrator, Tenant administrator, Junior analyst, Tier 1 analyst, or Tier 2 analyst.

You can download the scripts for responding by clicking the following link:

Download script

The login and password to access Check Point NGFW are stored in the file .envSample.

To use the script:

  1. Install the script in one of the following ways:
    • Via pip, for example:

      pip install -r requirements.txt

    • Offline installation.

      If you do not have internet access, you must install the script offline. In this case, do the following:

      1. Download the dependencies on a computer that has internet access, by running the following command:

        pip download -r requirements.txt

      2. Move the downloaded dependencies to the device on which you will run the script.
      3. Install the dependencies by using the command:

        pip install --no-index --find-links <folder_path_to_downloaded_dependencies> -r requirements.txt

  2. Configure the script in one of the following ways:
    • Via the ENV file, for example:

      cp .env.sample .env

      nano .env

    • In the body of the script (main.py), edit the parameters in the following strings:

      BASE_IP: str = getenv("BASE_IP", "your-ip")

      BASE_PORT: str = getenv("BASE_PORT", "your-port")

      LOGIN: str = getenv("LOGIN", "your-login")

      PASSWORD: str = getenv("PASSWORD", "your-password")

  3. Add deny rules for the IP addresses detected by Kaspersky Next XDR Expert and for malicious URLs.

To add a firewall rule that will block IP addresses:

  1. Run the script by using the add_firewall_rule command.
  2. Specify the IP addresses that you want to block.

    By default, the maximum number of IP addresses is 1000. You can edit this value, as described in the previous procedure at step 2 Configure the script.

    You must add valid IPv4 addresses, separated with commas and without spaces, for example:

    python main.py add_firewall_rule --ip_address "12.12.12.12, 13.13.13.13"

The deny rule for the selected addresses is added, for example:

![Adding content filtering rule](./assets/screencasts/main_add_firewall_rule.gif)

To delete a firewall rule that blocks IP addresses:

  1. Run the script by using the delete_firewall_rule command.
  2. Specify the IP addresses that you want to block.

    By default, the maximum number of IP addresses is 1000. You can edit this value, as described in the previous procedure at step 2 Configure the script.

    You must add valid IPv4 addresses, separated with commas and without spaces, for example:

    python main.py delete_firewall_rule --ip_address "12.12.12.12, 13.13.13.13"

The deny rule for the selected addresses is deleted.

To add a filtering rule that will block malicious URLs:

  1. Run the script by using the add_content_filter_file command.
  2. Specify the URLs that you want to block.

    The URLs must be separated with commas, and have an http:// or https:// prefix, for example:

    python main.py add_content_filter_rule --url "https://url_1.com, http://url_2.com.uk, http://qwerty.nl, http://zxc.xc"

The deny rule for the specified URLs is added, for example:

![Adding content filtering rule](./assets/screencasts/main_add_content_filtering_rule.gif)

To delete a filtering rule that blocks malicious URLs:

  1. Run the script by using the delete_content_filter_file command.
  2. Specify the URLs that you want to block.

    The URLs must be separated with commas, and have an http:// or https:// prefix, for example:

    python main.py delete_content_filter_rule --url "https://url_1.com, http://url_2.com.uk, http://qwerty.nl, http://zxc.xc"

The deny rule for the specified URLs is deleted.

To launch a script for responding through Check Point NGFW:

  1. In the main menu, go to the Monitoring & reporting section, and then in the Alerts or Incidents sections, click the ID of the required alert or incident.
  2. Click the Select playbook button, and then in the window that opens, select the playbook that you created for responding through Check Point NGFW.
  3. Click the Launch button.

    The selected playbook launches the script for responding through Check Point NGFW.

    If the operation is completed successfully, an appropriate message is displayed on the screen. Otherwise, an error message is displayed.

The result of the playbook launch is available in the alert or incident details, on the History tab.

Article ID: 290556, Last review: Dec 9, 2024
Page top